4 August 2020

(yet another) 100Bd/500 FSK-2

4 August 2020 update
some frequency, same timing, and same 511-bit sequence but the speed has switched to 50Bd (shift remains unchanged, 500Hz):

It's to notice that the 511-bit sequence is obtained using the seed  s=[0 0 0 0 0 0 0 0 1]  and transmitting the output in opposite polarity (i.e., inverting the polarity of the demodulated sequence we get the exact sequence generated with seed s=[0 0 0 0 0 0 0 0 1]):

up: LFSR sequence when seed = [0 0 0 0 0 0 0 0 1], down: received sequence after reversing the polarity

2 August 2020
Just to log interesting 100Bd/500 FSK-2 transmissions found on 9130 KHz (CF). Data sent consist of a repeated 511-bit pseudo-random sequence which is generated by the polynomial x^9+x^5+1 (Fig. 1); likely that sequence is used when no data to transmit is available or to mantain sync between transmitting and receive modem (see also ITU Recommendation O.153 [1]). Since the 100Bd/500Hz waveform is used in several systems, it's difficult to state the source; anyway, it's to notice that x^9+x^5+1 sequences (PRBS9) are also used in CIS-12 and more generally in T-230 family devices.

Fig. 1 - the 511-bit pseudo-random sequence

Looking at the two FSK tones, it seems that they preserve their phase after each switch-over (Fig. 2). By the way: F1 = 753.87 Hz (1:0.001326479), F2 = 1253.68 Hz (2:0.001595299), dF = 499.81 Hz.

Fig. 2

I followed the transmissions for some days, they usually take place on weekdays at 0943 and stop at 1100 (UTC times). I ran several TDoA attempts and results point to the Moscow area, unfortunately they do not exactly agree.

Fig. 3 - start stop period

Fig. 4 - some of the TDoA results

27 July 2020

CIS-11 (TORG 10/11)

CIS-11 (also designated as TORG 10/11) is a synchronous, duplex ARQ system requiring separate forward and return links. It's used mainly for aeronautical weather reports in CIS, thus transmissions normally take place in M2 alphabet (Cyrillic third-shift ITA-2). Modulation used is FSK2, usually 100Bd and 500Hz shift with 11-bit period (figure 1).

Fig. 11
Its characteristic 11-bit format consists of the 5 bits of the ITA-2 alphabet d4-d0 (but in reversed bit order: d0-d4), 2 system state bits s0 and s1 and 4 parity bits p0-p4: the checksum is calculated by modulo-2 addition from all 7 other bits (d4-d0 + s0-s1) as: 

p0 = d1 + d3 + d4 + s0
p1 = d0 + d2 + d4
p2 = d0 + d1 + d3 + s1
p3 = d0 + d2 + d3 + s0 + s1

Fig. 2
I wrote a simple Octave script (CIS11_detect.m) just to check CIS-11 streams and extract the 5-bit data in case of  successful result:

## usage: CIS11_detect(fn,e)
## input:  fn ... filename containing a string of 0's and 1's (no space between)
##         e  ... 0 doesn't exctract data
##            ... 1 extracts M2 data
## output: m  ... CIS-11 parity bits success [0..1]
##         a  ... aligned bit frames: parity bits in a(8:14), in case m > 0.9
##         fn_M2-data.txt
##                ASCII file with the exctracted data, in case m > 0.9 and e = 1

CIS11_detect is downloadable from:
(you will need the GNU Octave package [1] to run the script).

I checked two transmissions and results are shown in Figs. 3,4; note the values of the system state bits (the two solid columns) in the two streams.
Fig. 3
Fig. 4
The system state bits signal the link state and traffic information, below a possible relationship just based on the (few) analyzed recordings:
00   - idle or Request
01   - ?
10   - Cyrillic
11   - Latin
transition to Cyrillic traffic is signaled by 00000 10
transition to Latin traffic is signalled by 11111 11

CIS-11 uses also two "idle signals", according to ITU-R F.342-2 [2]): idle signal α "01101 00 1100" is used when no data to transmit is available and mantains sync between transmitting and receive modems; idle signal β "10101 00 0001" is the ARQ request character. It's to note that:
- both the idle signals have the system state bits set to 00
- if shifted(!) the idle signal β is CIS-11 compliant (look at start bit offset in Fig.5)
- idle signal α is a LFSR x^3+x^2+1 sequence
- idle signal β is a LFSR x^5+x^4+1 sequence

Fig. 5

CIS-81-81 (81-81, Moroz) T-206

A friend of mine sent me an interesting comment about the 6 and 12 bit formats used in CIS-81-81 mode, likely they refer to a former version of 81-81 and clear-text transmissions:

6-bit format (40.5 Bd): idle and traffic

12-bit format (81 Bd), two cahannels "a" and "b", bit-interleaved:

a) Channel a and b idle
b) Channel a traffic
c) Channel b traffic
d) Channel a and b traffic

(bits 2 and 5 are sent in inverted polarity).

July, 21 
Since in the last few weeks I have encountered mostly FSK2 signals (mostly from the East), I decided to take a slightly deeper look at "old" FSK2 modes such as CIS-81-81 and CIS-11 (the latter in a next post).
CIS-81-81, also designated as 81-81 (1) , T206-M 3M1 device, is the dual channel version of CIS-40.5 mode, hence the designation 81-81; "Moroz" ("FROST" in English) is just an old nickname for the mode [1]. Most likely, when operating in two channels the data are transmitted using time division multiplexing. Both 40.5 and 81 are quite "old" systems, most likely also in use by some ex USSR republic. Speculation is that this older 81-81 system, as defined above, is no longer in use and that the newer 81-81 system is most likely to be derived from CIS-14 or CIS-27 system (81-29 designation?) [2]. Some old reports from WUN logs indicate different users of these systems [2].

Shift           Common User
125             Navy   
500             Railway Authority
200,250,500,    Military

So far, I have at my disposal CIS-81 samples in two different shift patterns:

81Bd 250
Fig. 1
It's the 81-81 most interesting waveform since its demodulated stream exhibits a 24-bit pattern due to the  length of the idle signal which consists of 12 mark and 12 space bits (notice that CIS-40.5 250 uses 12-bit idle signal consisting of 6 mark and 6 space bits). The sequence generated by x^11+x^9+1 (PRBS11)  is used to scramble to the following data block or symply as "test" message; then the idle signal is repeated in opposite polarity (Fig. 3). Traffic in the channels is encrypted. It's worth noting that the polynomial and the idle signal "format" are the same in the 250Hz shift patterns of CIS 40.5 and 81 Baud.

Fig. 2 - CIS-81-81 250 


81Bd 500
Although the lack of the idle signals (at least in this recording), the demodulated stream is very interesting since it too can be descrambled using  the polynomial x^11+x^9+1 (Fig. 5).

T-206 MT "WESNA" (T-206 MT, T-206 2MT, T-206 3M und T-206 3M1)
T-206 is a Soviet teletype and data encryption family devices (not a modem!) used in stationary and mobile operation [3].

Fig. 5 - T206 MT [3]

The system has it roots in the synchronous, manual Baudot printing telegraph system whcih was used extensively already in Imperial Russia. The telegraph network of Imperial Russia was of course inherited by the Soviet Union, where the political leadership very soon realized that good telecommunications were at the roots of its modernization project. During and after WWII teleprinting was extended to radio links using either A1 or F1 modulation. It was therefore natural to adapt the old Baudot system to radio transmission and reception. As the system was synchronous its frame format needed a means to tell whether the link was active or idle, consequently a status bit was added in front of the five data bits yielding a 6-bit frame. For 2-channel systems this was naturally expanded to 2 x (1+5) = 12 bits. The system would then be transmitted as frame or bit interleaved. These systems used the first version of the International Telegraph Alphabet (ITA 1).

https://yadi.sk/d/WQikSYo77Z6oBA (250Hz shift, #1)
https://yadi.sk/d/bd81CpHyBFDuCQ (250Hz shift, #2) 
https://yadi.sk/d/-Q-4JagM1eeBHw (500Hz shift)                     

17 July 2020

CIS-14 FSK 100Bd/2000 (CIS 3x100)

Interesting 100Bd/2000 FSK signal spotted on 16059.5 KHz (CF), most likely a Russian Governative transmission. This signal is not a separate one, actually it must be considered as part of the CIS 3x100 "system" visible on the left in figure 1. Indeed, the main station operates a VFT 3x100bd/1440 signal and works simultaneously three outstations which in turn run the FSK 100Bd/2000 waveform (outstations are usually not far apart in frequency).

Fig. 1
As well as the mainstation (VFT 3x100Bd/1140), outstations too use CIS-14/T-207 (as from the analysis of the demodulated stream in figure 2); all use the same checksum mode [0312].
Fig. 2
A clearer illustration of this "system" is visible in the spectrum of figure 3, the IQ recording of which was provided by my friend KarapuZ [1] who discussed the signal here.

Fig. 3

14 July 2020

demodulating sync F7B mode transmissions using F7B.exe software

F7B signal, apparently a "classic" MFSK-4
My friend cryptomaster coded a program (F7B.exe) for demodulating synchronous F7B, it can be freely used and distributed for the analysis of such signals. Unfortunately, SA program parses these transmissions as classic MFSK-4 but that is not what actually is on-air: indeed,  F7B transmission mode deals with signals consisting of two independent but synchronous channels CH1 CH2 each carrying teletype signals (FSK2 on 2 independent channels).

F7B.exe can be downloaded from here:
Warning: F7B.exe is coded to run under win/32-bit systems so you may encounter a comdlg32.ocx error (component not correctly registered) when try to run it under x64 systems, here is how to resolve comdlg32.ocx missing error:

F7B.exe needs as input file the  raw MFSK-4 stream produced by the demodulator of SA and output two ASCII-Bit files CH1.txt and CH2.txt in the same directory of the input file:

Moreover, the Octave script T207_detect.m  has been used for the check of T207/CIS-14 mode [1]: it can be freely downloaded from here (you will need GNU Octave package [2] to run the script):
the Octave script T207_detect_e.m also extracts the two world and bit interleaved channels:

I tested the demodulator on the two  F7B modes 100Bd/1000 and 96Bd/500, both actively used by Ukrainian Nets; by the way, two preliminary observations:

1) usually, the two F7B channels CH1 CH2 are T-207 secured according to the CIS-14 mode [1]. Since CIS-14 consists of two independent 5-bit MTK-2 channels (transmitted in 14-bit frames), it turns out that those F7B transmissions may carry up to four independent 5-bit channels (CH1a, CH1b, CH2a, CH2b);

2) both those F7B waveforms have their FSK2 counterparts.

I also tested F7B.exe on the Rockwell TE-204, a "special" time-frequency diversity FSK4 mode most commonly used by Allied Air Forces as an air-to-ground messaging system as well as in ground and naval applications.

100Bd/1000 F7B

Fig. 1 - 100Bd/1000 F7B
100Bd/1000 F7B transmissions occupies about 3000Hz bandwidth with the four tones at -1500, -500, +500, +1500 Hz respect to the center frequency. As said above, 100Bd/1000 F7B transmissions may carry up to four independent 5-bit channels. In this regard, it's worth noting in figure 2 that - at least in this sample - the two F7B channels adopt different CIS-14 checksums: mode 20 (0312) in channel CH1 and mode 3 (3120) in channel CH2: who knows, maybe the two F7B channels carry the same data but with different checksums just to increase the redundancy of the system. Note that CIS-14 100Bd/1000  (the FSK2 counterpart) uses the checksum mode 20.

Fig. 2 - two 100Bd/1000 F7B channels, each transporting two CIS-14 channels (CH1a, CH1b, CH2a, CH2b)

96Bd/500 F7B
Fig. 3 - 96Bd/500 F7B
96Bd/500 F7B transmissions occupies about 1500Hz bandwidth with the four tones at -750, -250, +250, + 750 Hz respect to the center frequency. The same earlier conclusion applies: that is since CIS-14 consists of two independent channels,  96Bd/500 F7B transmissions too may carry up to four independent 5-bit channels.
I don't know if it's a mere coincidence, anyway it's interesting to note in figures 4,5 that only one channel transports data, as well as the CIS-14 96Bd/500 (the FSK2 counterpart) does: i.e., either 96Bd/500 F7B either 96Bd/500 FSK2 use only one of their two "available" channels.  Both the waveforms use the CIS-14 checksum mode 20.

Fig. 4 - two 96Bd/500 F7B channels, only one of the two available CIS-14 channels is used

Fig. 5 - CIS-14 96Bd/500 FSK2 channels, only one of the two available 5-bit channels is used
In this transmission the two channels use different EOT signaling sequences (figure 6)

Fig. 5

Rockwell TE-204 FSK4
Although TE-204 does not definitely use the F7B mode, I decided to check it since regards two FSK2 channels. Indeed, TE-204 transmits the "mark" on 935 Hz for 6.67 msec period followed by a replicated 6.67 msec "mark" at 1815 Hz. Similarly, the "space" is transmitted at 1375 Hz for 6.67 msec followed by a replicated 6.67 msec "space" at 2255 Hz (figure 6). This "mode" provides an in-band frequency  and time diversity function  (thus the speed is the half of the measured one). As for above, from the perspective of the  data-transfer, the modem works as a 75Bd/880Hz FSK2 modem.

Fig. 6
Well, decoding separately the two FSK2 channels (935-1375, 1815-2255) we get obviously two time-shifted similar streams (figure 7)

Fig. 7 - the two TE-204 demodulated FSK2 streams
Demodulating it as if it were an F7B signal we get "01" sequences in channel CH1 and  (expected) duplicated data in channel CH2 (figure 8)

Fig. 8

https://yadi.sk/d/f0U80pRg3F58iA  (F7B signals)

[1] https://i56578-swl.blogspot.com/.../redefining-t-207-checksums.html
[2] https://www.gnu.org/software/octave/

4 July 2020

STANAG-4481F from NSY, back to normal op

(for background read all the post of this topic
After a period during which the signals showed a strange behavior consisting of a 3-bit period (which in some way "simulated" a 50Bd speed), it seems that the transmissions from NSY Niscemi have back to normal 75Bd operations. So far, I checked almost all the channels except 8145.0 and 8204.5 KHz (and 13229.0 Khz but from NAU Isabela).

Fig. 1 -  6732 KHz from NSY Niscemi in different dates
There is however a peculiarity that is noteworthy: according to my logs and analysis NSY is the only station that uses KW-46 encryption - instead of KG-84 - with the 4481F 75Bd waveform(!), the other stations that use that encryption all adopt the 50Bd waveform. This fact modifies the content of a previous post according to the following diagrams (although provisional).

Fig. 2 - 6732 KHz streams from NSY Niscemi in different dates
Fig. 3

3 July 2020

50Bd/300 async 5N1.5 FSK (likely Serbian-Mil)

6374.8 KHz (cf) async 50Bd/300 FSK using 5N1.5 framing, after demodulation:

Friends from UDXF group suggest Serbian Army as the user.


30 June 2020

CIS-75 FSK 75Bd/250 (3): 126-bit LFSR sequence

(for background, read all the posts of this topic)
Russ-Mil CIS-75 75Bd/250 FSK system spotted this morning on 15832.0 KHz (cf). After differential decoding, the bitstream shows a clear 385-bit period and a 126-bit pseudo random sequence, generated by the polynomial x^7+x^6+1, which is inserted in the data stream probably to re-sync the receive modem among the messages:


Fig. 1 - 126-bit pseudorandom sequences
Fig.2 - the synched stream
It's interesting to note that in previous CIS-75 recordings, we saw the use of a 128-bit (!) length pseudo-random sequence transmitted in positive and negative polarity: those sequences are easily identifiable by inspecting the stream with a window, coincidentally, 385-bit wide.
By the way, the same polynomial x^7+x^6+1 is also used by the French-Ny in their 50Bd/850 FSK fleet broadcast as one of the two stream LFSR delimiters [1].  

29 June 2020

unid 40.4Bd/800 FSK & FSK/Morse

6800.0 KHz (cf): unusual 40.4Bd/800 FSK long time reversals then into FSK/Morse "UUG4 de UTN7 ZC GB 73 SK" and off-air. Most likely a CIS network.
Comments are welcome 😄

23 June 2020

CIS Navy 50Bd/500 FSK 136 bit (T600-136)

Yet another 50Bd/500 FSK transmission, this time recorded monday morning on 14704.0 KHz (cf) around 1340Z and almost surely sourced by the CIS Navy T600 system (typical shifts: 200, 250, and 500 Hz): given the 136-bit length frames this waveform is also known as "T600-136".

Fig. 1 - FSK parameters
Note that the full transmission period is 544-bit length, i.e. 4 x 136-bit frames. Indeed, from a quick examination of the demodulated bitstream (Fig. 2), it is easy to see that it's composed of blocks of four repeated frames, probably to add redundancy to the system.

Fig. 2 - CIS-Ny 50Bd/500 bitstream (136-bit frames)
The same 136-bit framing is also used in the CIS-Ny 50Bd/250 FSK, still from a T600 system (Fig. 3): these two waveforms seem to be used to carry the same "type" of messages unlike the CIS-Ny 50Bd/200 FSK which shows a different structure of the frames (70-bit Message Indicator, 4:3 ratio,...) and it's mainly used for fleet broadcast.

Fig. 3 - CIS-Ny 50Bd/250 bitstream (136-bit frames)

Although the shift is a multiple of the manipulation speed, the two tones do not preserve their phase (Fig. 4).

Fig. 4 - CIS-Ny 50Bd/500 tones